Stay ahead of cyber threats with expert insights, tutorials, and industry updates from our security team.
50+ step-by-step guides on installation, configuration, integrations and troubleshooting, all based on official Wazuh documentation.
Showing 50 of 50 guides
Open-source and self-hosted, or cloud-native and consumption-billed? How Wazuh and Microsoft Sentinel differ, and how to pick the right SIEM for your environment.
Install the full Wazuh server stack, indexer, manager and dashboard, on a single Ubuntu 24.04 LTS host using the official assistant in under 15 minutes.
Install the Wazuh agent across Linux, Windows and macOS endpoints and enroll them to your Wazuh manager with a single command per platform.
Deploy the Wazuh stack across dedicated nodes the way a production environment should run, separate indexer, server and dashboard hosts with proper TLS.
Spin up the full Wazuh stack, indexer, manager and dashboard, in containers using the official docker-compose, in single-node or multi-node mode.
A practical walkthrough for running Wazuh on AWS EC2, pick the right instance, lock down the security group, mount fast EBS and install the stack with the official assistant.
Right after the Wazuh installer finishes, run through this hardening checklist before exposing anything, password rotation, TLS, firewall, backups and retention.
Step-by-step Wazuh indexer install: certificate generation, repository setup, node install and cluster initialization for single-node or multi-node deployments.
Install the Wazuh server: manager and Filebeat: following the official step-by-step guide. Repo setup, install, cert deployment, Filebeat config and service start.
Install the Wazuh dashboard step by step, dependencies, repo setup, package install, certificate deployment, opensearch_dashboards.yml tweaks and first login.
Install Wazuh on air-gapped networks with the official offline installation assistant, pre-download packages on a connected host, then install on the isolated target.
Install the Wazuh agent on Debian, Ubuntu, RHEL, CentOS, Rocky, Alma, openSUSE and Amazon Linux using the official Wazuh deployment variables.
Install the Wazuh agent on Windows with the official MSI, interactive, silent and GPO-based mass deployment with deployment variables.
Install the Wazuh agent on Intel and Apple Silicon Macs using the official pkg installer and Wazuh deployment variables.
Install the Wazuh agent on Solaris, AIX and HP-UX endpoints using each platforms native package manager.
Mass deploy the Wazuh agent with the official Wazuh Ansible roles, one playbook, every endpoint enrolled to the manager.
Run Wazuh on Kubernetes with the official manifest repo, indexer StatefulSet, manager Service, dashboard Ingress and persistent storage.
Use the official Wazuh Puppet module or Chef cookbook to automate Wazuh agent and manager installs across managed nodes.
When a Wazuh agent does not show up as Active, work through this checklist, firewall, time, keys, certs, manager binding and the agents own logs.
Wazuh indexer red or yellow? Disk full? Pods restarting? Work through this checklist to identify and fix the most common indexer issues.
Wazuh dashboard not loading or rejecting login? Work through this checklist, credentials, security index, certificates, browser cache and the service log.
Manage hundreds of Wazuh agents with shared configuration files. Create groups, assign agents and roll out policy changes from the manager.
Detect unauthorized changes to system files with Wazuh FIM. Configure real-time monitoring, who-data auditing and PCI/HIPAA-ready file alerts.
Turn Wazuh into a vulnerability scanner. Enable CVE feeds, schedule scans and triage findings inside the Wazuh dashboard.
Stop attacks automatically. Configure Wazuh Active Response to block IPs at the firewall the moment a brute-force rule fires.
Ingest any log source into Wazuh: text files, journald, Windows events, command output. Full localfile reference with examples.
Detect anything in any log. Learn to write Wazuh decoders, rules and use ossec-logtest to debug them before they hit production.
Talk to Wazuh programmatically. Get a JWT token, query agents and automate tasks via the REST API.
Scale Wazuh Indexer beyond a single node. Bootstrap a 3-node cluster with TLS, dedicated masters and shard replicas.
Scale Wazuh manager horizontally. One master, many workers, shared configuration, the supported pattern for large agent fleets.
Get rid of the browser warning. Install a CA-signed TLS certificate on Wazuh Dashboard the right way.
Auto-scan every new file Wazuh sees against 70+ AV engines using the VirusTotal API.
Pipe high-severity Wazuh alerts straight into your SOC Slack channel using the official integration.
Turn Wazuh alerts into TheHive cases. Get a full SOC workflow with observables, tasks and Cortex analyzers.
Every Wazuh rule ships with MITRE ATT&CK metadata. Use the dashboard module to track coverage and threat actor TTPs.
Continuously scan every server against CIS Benchmarks using the Wazuh SCA module. No extra agents required.
See every docker exec, image pull and container start in Wazuh, using the built-in docker-listener wodle.
Monitor your AWS account with Wazuh. Ingest CloudTrail, GuardDuty and VPC Flow logs through the official AWS wodle.
Bring Azure AD sign-ins and Activity logs into Wazuh with the native azure-logs wodle.
Watch your GCP project from Wazuh. Stream Cloud Audit Logs through Pub/Sub into the native gcp-pubsub wodle.
Monitor Microsoft 365: Exchange, SharePoint, Teams, Entra ID audit events, all inside Wazuh.
Open-source XDR/SIEM vs the indexing-data heavyweight. Where each one wins, where it hurts, and how to pick without regret.
Both are open-source SIEMs. One is security-first, the other is search-first. Here is how to choose for your SOC.
OSSEC was the original open-source HIDS. Wazuh forked it, modernized everything, and now runs in thousands of production SOCs. Here is what changed.
Graylog ingests logs beautifully. Wazuh does that plus EDR, FIM, vulnerability detection and 4,000+ security rules. Different tools, different jobs.
Lock down your Wazuh deployment with 10 production-tested hardening steps, credentials, TLS, network, RBAC, backups and audit logging.
Stop drowning in noisy Wazuh alerts. A practical tuning loop, baseline, suppress, raise levels, measure, to get to a clean SOC queue.
A hands-on walkthrough of writing your first Wazuh detection rule, from log to decoder to rule, with five worked examples.
Build a Wazuh retention strategy that survives audits and storage bills, ISM policies, snapshots, and a compliance-aligned tiered model.
From 10 agents to 10,000, a battle-tested playbook for Wazuh fleet management: groups, agent.conf, enrollment automation and rolling upgrades.
A complete walkthrough for integrating Wazuh with Datadog on AWS EC2, forwarding security alerts to Datadog for unified observability.
Key Topics:
Transform your high-severity security alerts into trackable risks, automatically, no paid extras required.
Key Topics:
A practical walkthrough for analyzing security threats in a three-tier web application using STRIDE and OWASP Threat Dragon.
Key Topics:
Detect Living-Off-The-Land binaries abuse on Windows by combining Sysmon Windows API telemetry with Wazuh SIEM detection rules.
Key Topics:
A deep dive into Event Tracing for Windows (ETW) analysis and common bypass techniques attackers use, demonstrated on AWS Windows EC2.
Key Topics:
Step-by-step guide to building a hands-on security lab integrating DVWA (Damn Vulnerable Web Application) with Wazuh SIEM for attack detection practice.
Key Topics:
How I built an automated malware detection system using open-source tools, Wazuh File Integrity Monitoring combined with YARA rules.
Key Topics:
A practical implementation guide for forwarding Amazon GuardDuty findings into Wazuh SIEM for centralized cloud threat detection.
Key Topics:
A deep dive into automated security incident response, designing enterprise-grade email alerting pipelines for Wazuh.
Key Topics:
Introduction and complete walkthrough for deploying the Wazuh agent on AWS EC2 instances, enrollment, configuration, and verification.
Key Topics:
Convert generic Sigma detection rules into Wazuh-compatible rules so real-world threats get caught by your SIEM.
Key Topics:
In a SOC environment a customized Wazuh dashboard builds trust, improves usability, and reflects ownership of the platform.
Key Topics:
Detect fake bank alerts and credential-harvesting links by wiring an automated email phishing pipeline into Wazuh.
Key Topics:
Connect Wazuh 4.14.2 alerts to Rootly for structured incident management, on-call routing, and post-incident reviews.
Key Topics:
Critical post-install hardening for Wazuh 4.14.1, rotate the default credentials right after installation.
Key Topics:
Scenario, problem, and the fix, step-by-step setup for serving multiple tenants from a single Wazuh deployment.
Key Topics:
Detect SSH brute force attempts in real time and trigger automatic IP blocking using Wazuh active response.
Key Topics:
Configure Wazuh File Integrity Monitoring from scratch, the basic settings that catch unauthorized file changes.
Key Topics:
Step-by-step walkthrough of the manage_agents CLI tool for adding, listing, and removing Wazuh agents from the manager.
Key Topics:
Why deploying the Wazuh agent strengthens monitoring and response capabilities across endpoints and servers.
Key Topics:
Step-by-step guides and how-to articles for security tools and techniques.
View All →Industry standards and proven strategies for effective security operations.
View All →Honest evaluations of security tools, platforms, and technologies.
View All →Threat intelligence updates, trend analysis, and expert commentary.
View All →Real-world success stories and lessons learned from client engagements.
View All →Tips and guidance for cybersecurity professionals advancing their careers.
View All →Essential steps for successful Wazuh implementation.
Compare features, pricing, and use cases for popular SIEM solutions.
Ready-to-use templates for common security incidents.
Comprehensive checklist for evaluating cloud security posture.
Hands-on SOC analysts sharing real-world experiences and techniques.
Certified professionals covering Azure, AWS, and GCP security topics.
Ethical hackers providing insights into vulnerability assessment and exploitation.
Instructors creating educational content for security professionals at all levels.
Stay updated with the latest cybersecurity trends, tutorials, and exclusive content from WazuGuardix experts.
What You'll Receive:
We respect your privacy. Unsubscribe anytime.